Running your own mail server while relaying outbound through a sending provider introduces three key challenges. First, DKIM signing: your server and the provider both sign messages, but you must exclude headers the relay rewrites (like Message-ID) from your own signature to avoid verification failures. Second, SPF is evaluated against the envelope sender (MAIL FROM), not the From header — providers use their own bounce subdomain, so your apex SPF record only matters for direct sends bypassing the relay. Third, visibility gaps: your logs only confirm the relay accepted the message; actual delivery outcomes (bounces, deferrals, spam filing) are only visible through DMARC aggregate reports, TLS-RPT, or provider webhook/API events. Additionally, using PROXY protocol preserves real client IP addresses through NAT/proxy hops, preventing shared abuse-control fate across all clients.
